Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Information We Collect

Account Information

When you create an account, we collect your email address and generate a unique user ID. You can sign up using email and password, Apple Sign In, or Google Sign In. We do not collect your name, phone number, or any other personal identification information during sign up.

Workout Data

Data you create within the app, including workout programs, exercises, workout logs (sets, reps, weights, times, notes), additional measurements you add, calendar schedules, and custom exercise libraries.

Activity Data

We log the date you open the app and the platform you use (iOS or Android), limited to one entry per day. We also collect usage analytics, such as which screens are visited and which actions are taken, to understand how the app is used and improve the experience.

In-App Purchase Data

Records of any optional in-app purchases you make, managed through RevenueCat.

Advertising Measurement

When you install the app after seeing one of our ads, we measure the performance of our own advertising campaigns through Meta's SDK. On iOS this relies on Apple's SKAdNetwork, which reports installs to us in an aggregated, privacy-preserving way that does not identify you. We do not collect your device advertising identifier (IDFA), we do not show you a tracking prompt, and we do not track you across other companies' apps or websites.

Feedback

If you choose to respond to in-app feedback prompts, we store your response.

Information We Do NOT Collect

• Name or physical address
• Precise location data
• Contacts or address book
• Photos or media files
• Browsing history
• Advertising identifiers (IDFA)
• Payment or billing information

3. How and Why We Use Your Data

We use your personal data for the following purposes:

• Account information: to authenticate you, manage your account, and enable data sync across your devices
• Workout data: to provide the core functionality of the app, creating, tracking, and managing your workouts
• Activity data: to understand general usage patterns, such as which screens are visited, and improve the app
• In-app purchase data: to record and manage any optional in-app purchases you make
• Advertising measurement: to measure the performance of our own advertising campaigns in aggregate, through Apple's SKAdNetwork, without identifying you
• Feedback: to improve the app based on user input

4. Legal Basis for Processing

Under the GDPR, we process your personal data on the following legal bases:

• Contract performance: Processing your account information and workout data is necessary to provide you with the service you signed up for.
• Legitimate interest: Processing activity data to understand usage patterns and improve the app. We have assessed that this processing does not override your rights, as the data is minimal (date, platform, and activity data like screen views, buttons clicked, etc) and cannot be linked with behaviour outside the app.
• Consent: Processing feedback data, which you voluntarily provide. You can withdraw consent at any time by contacting us.
• Legitimate interest: Measuring the performance of our own advertising campaigns in aggregate through Apple's SKAdNetwork, which does not identify you and does not track you across other apps or websites.

5. Data Storage and Security

Virtus Athlete uses a local-first architecture. Your data is stored on your device in a local database and automatically synced to secure cloud servers when an internet connection is available. The app works fully offline. Any changes you make while offline are synced to the cloud when your connection is restored.

We implement the following measures to protect your data:

• Row-level security ensuring you can only access your own data
• Encrypted authentication tokens
• Secure HTTPS connections for all data transmission
• Automatic session management with secure token refresh

6. Data Retention

We retain your personal data for as long as your account is active. Specifically:

• Account and workout data: retained until you delete your account
• Activity data: retained until you delete your account
• In-app purchase data: retained until you delete your account and as required by the platform payment provider
• Feedback: retained until you delete your account

When you delete your account, all your data is permanently removed from our servers. This action cannot be undone.

7. Third-Party Services

We use the following third-party data processors to operate the app:

• Supabase: authentication and cloud database hosting
• PowerSync: sync orchestration between your device and the cloud
• RevenueCat: in-app purchase management
• Google Analytics: app and website usage analytics
• Meta Platforms: advertising attribution and app event measurement for our own app-install campaigns
• Apple / Google: social sign-in (only if you choose to use it)

These services act as data processors on our behalf and are bound by data processing agreements in accordance with GDPR requirements.

We do not sell your data to any third party. We use Meta's advertising tools solely to measure and optimize our own app-install advertising campaigns, and we do not display third-party advertising inside the app. Beyond the processors listed above, we do not share your personal data with any other parties unless required by law or a valid legal order from a competent authority.

8. International Data Transfers

Depending on your location and the third-party services involved, processing of your data may take place in countries other than your own. Where this happens, the third-party services we use are bound by the safeguards set out in their own standard data processing terms.

9. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate personal data
• Right to erasure: request deletion of your personal data (see Account and Data Deletion below)
• Right to restriction: request that we restrict the processing of your data
• Right to data portability: request your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at contact@virtusapp.ai. We will respond to your request within 30 days.

You also have the right to lodge a complaint with your local data protection authority or any competent supervisory authority in the EU.

10. Account and Data Deletion

Account Deletion

You can delete your account from within the app. This permanently deletes all your data from both your device and our servers. This action cannot be undone.

Data Deletion Without Account Deletion

You can delete specific data from within the app such as workout logs, programs, exercises, and measurements without deleting your account. You can also clear all your data at once while keeping your account. Deleted data is permanently removed from both your device and our servers.

Signing Out

Signing out clears your local data from the device. Your data remains stored securely on our servers and will sync back when you sign in again.

Uninstalling

Uninstalling the app removes all local data from your device. Your cloud data remains on our servers until you delete your account.

Device Backups

Your data may also be included in your device's backup system (such as iCloud or Google backups). Device backups are managed by your device's operating system, not by Verum Services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page and will include an updated "Last Updated" date. For significant changes, we will make reasonable efforts to notify you through the app or by email.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at: